AmZetta Technologies, LLC shim-15.8 x64

amzdev0401 commented 7 months ago

Confirm the following are included in your repo, checking each box:

[x] completed README.md file with the necessary information
[x] shim.efi to be signed
[x] public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
[x] binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
[x] any extra patches to shim via your own git tree or as files
[x] any extra patches to grub via your own git tree or as files
[x] build logs 'https://github.com/amzdev0401/shim-review/blob/AmZetta-shim-x86_64-20240220/build.log'
[x] a Dockerfile to reproduce the build of the provided shim EFI binaries 'https://github.com/amzdev0401/shim-review/blob/AmZetta-shim-x86_64-20240220/Dockerfile'

What is the link to your tag in a repo cloned from rhboot/shim-review?

https://github.com/amzdev0401/shim-review/tree/AmZetta-shim-x86_64-20240220

What is the SHA256 hash of your final SHIM binary?

a5e223647b0ba12cf8e6947de6b253dd5fba7f1f7c0356f55c387d7e64e5440a shimx64.efi

What is the link to your previous shim review request (if any, otherwise N/A)?

https://github.com/rhboot/shim-review/issues/321

amzdev0401 commented 7 months ago

@dennis-tseng99 @aronowski @THS-on

I have resubmitted the latest SHIM 15.8. I kindly request you to review this new submission.

aronowski commented 7 months ago

Build reproduces, SHA256 sum matches (more on this in a moment). The binaries' characteristics are fine, no NX support, as the whole chain is not NX-compatible.

The application is generally alright, with some minor errors caused most likely due to some entries not being updated from an earlier application, where they were fine. I found these:

There's an error that GRUB2 still has the upstream grub,3 entry, but an answer above the SBAT entries mentions that it's been set to 4.
An older SHA-256 checksum has been provided in the latest README. Please, update it.
It should be a5e223647b0ba12cf8e6947de6b253dd5fba7f1f7c0356f55c387d7e64e5440a just like in the current GitHub issue.
At last, a minor rendering error is present in the GitHub issue's original post - an extra space has been added, making the checkboxes not render properly.

They can be fixed easily - please do so, update the tag in the original post and ping me for a quick re-review.

amzdev0401 commented 7 months ago

@aronowski @THS-on @dennis-tseng99

Thank you for the review, I have fixed the issues you mentioned and I have created the release label v1.0.7 with the fixes.

https://github.com/amzdev0401/shim-review/releases/tag/AmZetta-shim-x86_64-20240220

dennis-tseng99 commented 7 months ago

Sure, I will try my best. Currently, the binaries can be reproducible by podman when being tested at midnight. Please wait.

dennis-tseng99 commented 7 months ago

=== Review for AmZetta Technologies, LLC shim-15.8 x64 #383 ===

Binaries are producible based on tag AmZetta-shim-x86_64-20240220
No extra patches are applied.
NX flag is disable: shim-review# objdump -x shimx64.efi | grep -E 'SectionAlignment|DllCharacteristics' SectionAlignment 0000000000001000 DllCharacteristics 00000000
built hash matches the original one; and already fixed the incorrect hash in README.md pointed out by @aronowski. a5e223647b0ba12cf8e6947de6b253dd5fba7f1f7c0356f55c387d7e64e5440a
produce-specific generation number is equal to 1 is reasonable because you said This is your first time SHIM submission for shim: sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim shim.amzetta,1,AmZetta Technologies,shim,15.8,https://amzetta.com/ for grub: sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md grub,4,Free Software Foundation,grub,2.11,https://www.gnu.org/software/grub/ grub.amzetta,1,AmZetta Technologies,grub2,2.11-65bc45963,https://amzetta.com/
Certificate Validity: shim-review# openssl x509 -in amzetta.der -inform der -noout -text Validity Not Before: Feb 27 20:26:36 2023 GMT Not After : Feb 24 20:26:36 2033 GMT 10 years is good for user
Minor suggestion: For the next submission, please specify more details about the contact information for your product when you specify vendor_url field, or just use email instead. For example, you might change it to: grub.amzetta,1,AmZetta Technologies,grub2,2.11-65bc45963,https://amzetta.com/products/ztc/packages/grub

Conclusion:
It is acceptable to me
@aronowski needs your ping for the 2nd quick re-view .

aronowski commented 7 months ago

Awesome! Accepting it.

amzdev0401 commented 7 months ago

@aronowski @THS-on @dennis-tseng99

A big thank you to everyone. Greatly appreciated!!

amzdev0401 commented 5 months ago

@aronowski @THS-on @dennis-tseng99

Thank you all. Our SHIM was approved by Microsoft. Greatly appreciated!!

rhboot / shim-review